test(nat): require OPEN for public TCP listeners receiving connections

tests/stream_netns/nat_scenario.py

@@ -116,12 +116,15 @@ def check_profiles(scenario):
         for owner in public + [node for node in NODES if node.nat]:
             observer = second if owner.name == first.name else first
             connect(owner, observer, "tcp")
+            if not owner.nat:
+                connect(observer, owner, "tcp")
             data = scenario.wait(f"nat-tcp-ip-{owner.name}", lambda statistics:
                                 profile(statistics[owner.name], "tcp")["source"] == "ETCP" and
-                                bool(profile(statistics[owner.name], "tcp")["external"]), 10)
+                                bool(profile(statistics[owner.name], "tcp")["external"]) and
+                                (bool(owner.nat) or profile(statistics[owner.name], "tcp")["inbound"] == "OPEN"), 10)
             actual = profile(data[owner.name], "tcp")
-            # second принимает первый TCP от first; остальные проверяемые сокеты здесь исходящие.
-            expected = ("UNKNOWN" if owner.nat else "UNCHANGED", "OPEN" if owner.name == second.name else "UNKNOWN")
+            # Публичные listener принимают соединения в обе стороны; клиент за NAT даёт только IP:0.
+            expected = ("UNKNOWN", "UNKNOWN") if owner.nat else ("UNCHANGED", "OPEN")
             ip = next(item for item in NATS if item.name == owner.nat).ip if owner.nat else owner.ip
             if (actual["mapping"], actual["inbound"], actual["external"]) != (*expected, f"{ip}:0"):
                 raise RuntimeError(f"{owner.name}/tcp: expected {expected}, IP={ip}:0, detector returned {actual}")